Splunk Search

Rex field to extract dot net module

Explorer

Hi i currently have the following line in my search that search for system.net.webclient:

|rex max_match=0 "(?<module>(system.net.webclient))"

May i know how do i amend this to search for any syntax that match system.xxx.xxx so it work for all the module?

Tags (2)
0 Karma
1 Solution

Champion

Hi

check this

| makeresults 
| eval test= "system.com.testclient" 
| rex field=test max_match=0 "(?<module>(system\.\w+\.\w+))"

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try |rex max_match=0 "(?<module>system\.[^\.]+\.\S+)".

---
If this reply helps you, an upvote would be appreciated.
0 Karma

Explorer

This actually works better if the data was more organize; sadly my data was not and it capture too many noise

0 Karma

Champion

Hi

check this

| makeresults 
| eval test= "system.com.testclient" 
| rex field=test max_match=0 "(?<module>(system\.\w+\.\w+))"

View solution in original post

0 Karma